Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors
Summary: Unit 42 investigated destructive attacks from January through October 2023 against Israel's education and technology sectors, attributed to the Iranian-linked APT group Agonizing Serpens (aka Agrius), which stole PII and intellectual property before deploying wipers to cover its tracks. In an October 2023 incident, the attackers gained access through vulnerable internet-facing web servers, deployed ASPXSpy-based web shells, used tools including sqlextractor to pull SQL data into CSV files, and attempted three wipers - MultiLayer, PartialWasher and BFG Agonizer - all of which Cortex XDR prevented.
What's compelling: This group's wipers delete shadow copies, clear Windows Event Logs and overwrite the first 512 bytes of the boot sector, so a single missed detection leaves endpoints that cannot boot and data that cannot be restored. The October attack did not request ransom at all - the goal was vast data loss and business disruption, which means paying is not a recovery plan.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026